@spinajs/orm 2.0.481 → 2.0.482

package/lib/cjs/model.js

@@ -13,11 +13,14 @@ const hydrators_js_1 = require("./hydrators.js");
 const exceptions_js_1 = require("./exceptions.js");
 const dehydrators_js_1 = require("./dehydrators.js");
 const relation_objects_js_1 = require("./relation-objects.js");
+const snapshot_js_1 = require("./snapshot.js");
+const unit_of_work_js_1 = require("./unit-of-work.js");
 const di_1 = require("@spinajs/di");
 const luxon_1 = require("luxon");
 const lodash_1 = __importDefault(require("lodash"));
 const uuid_1 = require("uuid");
 const descriptor_js_1 = require("./descriptor.js");
+const primary_keys_js_1 = require("./primary-keys.js");
 const MODEL_PROXY_HANDLER = {
     set: (target, p, value) => {
         if (target[p] !== value) {
@@ -44,8 +47,16 @@ function updateModelDescriptor(targetOrForward, callback) {
     if (!target) {
         return;
     }
-    const metadata = Reflect.getMetadata(symbols_js_1.MODEL_DESCTRIPTION_SYMBOL, target);
-    callback(metadata[target.name]);
+    // Must go through getInheritedDescriptor like every other write of this
+    // symbol - it hands back the class's OWN descriptor, so mutating it here
+    // cannot leak into the base class ( eg. assigning the driver to a subclass )
+    const descriptor = (0, di_1.getInheritedDescriptor)(target, symbols_js_1.MODEL_DESCTRIPTION_SYMBOL, descriptor_js_1.createDefaultModelDescriptor);
+    // Name is this class's own, never inherited from the base. Matters when this
+    // is the FIRST access for the class: the descriptor is created by collapsing
+    // the chain, and the merger keeps the ancestor's non-empty Name over the
+    // default '' ( eg. a subclass would be stored under its parent's name )
+    descriptor.Name = target.name;
+    callback(descriptor);
 }
 class ModelBase {
     /**
@@ -80,24 +91,41 @@ class ModelBase {
         }
         return this._container;
     }
+    /**
+     * Primary key column names of this model. One element for the common single-column case.
+     */
     get PrimaryKeyName() {
         return this.ModelDescriptor.PrimaryKey;
     }
+    /**
+     * Primary key value: a scalar for a single-column key, a tuple in key order for a composite key.
+     */
     get PrimaryKeyValue() {
-        return this[this.PrimaryKeyName];
+        return (0, primary_keys_js_1.pkValueOf)(this, this.ModelDescriptor);
     }
+    /**
+     * Accepts a scalar for a single-column key, and an array in key order or an object keyed by
+     * column name for a composite key. Cascades the new value into loaded relations exactly as
+     * before, using the single-column relation key ( relations join on one column pair ).
+     */
     set PrimaryKeyValue(newVal) {
-        this[this.PrimaryKeyName] = newVal;
+        (0, primary_keys_js_1.setPkValue)(this, this.ModelDescriptor, newVal);
         this.ModelDescriptor.Relations.forEach((r) => {
             const rel = this[r.Name];
             if (!rel)
                 return;
+            // A relation's ForeignKey names ONE column, so it can only carry a single-column key.
+            // Cascading a composite parent key into children is not expressible and is skipped.
+            if ((0, primary_keys_js_1.isCompositePk)(this.ModelDescriptor)) {
+                return;
+            }
+            const scalar = (0, primary_keys_js_1.pkValueOf)(this, this.ModelDescriptor);
             switch (r.Type) {
                 case interfaces_js_1.RelationType.One:
-                    rel[r.ForeignKey] = newVal;
+                    rel[r.ForeignKey] = scalar;
                     break;
                 case interfaces_js_1.RelationType.Many:
-                    rel.forEach((rVal) => (rVal[r.ForeignKey] = newVal));
+                    rel.forEach((rVal) => (rVal[r.ForeignKey] = scalar));
                     break;
                 case interfaces_js_1.RelationType.ManyToMany:
                     // TODO: rethink this
@@ -105,6 +133,122 @@ class ModelBase {
             }
         });
     }
+    /**
+     * The diff baseline for this instance, or `null` when it has never been hydrated from
+     * the database. Read-only from the outside: mutate it only through `takeSnapshot()`,
+     * `snapshotRelation()` and `clearSnapshot()`.
+     */
+    get Snapshot() {
+        return this.__snapshot__;
+    }
+    /**
+     * Captures the current value of every column as the diff baseline, discarding any
+     * previous baseline and any relation keys recorded against it.
+     *
+     * Values are copied, never aliased — see `snapshotValue`. An aliased snapshot makes
+     * every diff empty and `save()` a silent no-op.
+     */
+    takeSnapshot() {
+        const snapshot = (0, snapshot_js_1.createSnapshot)();
+        for (const c of this.ModelDescriptor?.Columns ?? []) {
+            snapshot.Columns.set(c.Name, (0, snapshot_js_1.snapshotValue)(this[c.Name], c.Converter));
+        }
+        this.__snapshot__ = snapshot;
+    }
+    /**
+     * Records the primary keys of the members currently in relation `name` as that
+     * relation's baseline. A no-op when the model has no snapshot — an unhydrated model
+     * has nothing to diff against and its relations are all "new".
+     *
+     * @param name - relation property name, as declared on the model descriptor
+     */
+    snapshotRelation(name) {
+        if (!this.__snapshot__) {
+            return;
+        }
+        const relation = this[name];
+        if (relation === null || relation === undefined) {
+            return;
+        }
+        if (relation instanceof relation_objects_js_1.SingleRelation) {
+            const value = relation.Value;
+            this.__snapshot__.Relations.set(name, value ? [value.PrimaryKeyValue] : []);
+            return;
+        }
+        if (typeof relation[Symbol.iterator] === 'function') {
+            this.__snapshot__.Relations.set(name, [...relation].map((m) => m.PrimaryKeyValue));
+        }
+    }
+    /**
+     * Discards the diff baseline. After this the model is treated as brand new by `save()`.
+     */
+    clearSnapshot() {
+        this.__snapshot__ = null;
+    }
+    /**
+     * Names of the columns whose current value differs from the snapshot.
+     *
+     * With no snapshot every column is reported as changed, which is the right answer for a
+     * model that is about to be inserted.
+     *
+     * This is deliberately independent of `__dirty_props__`: the proxy records a property as
+     * dirty on any write, including one that puts the original value back, so the snapshot
+     * diff is the more precise answer and the one the UPDATE payload is built from.
+     */
+    changedColumns() {
+        const columns = this.ModelDescriptor?.Columns ?? [];
+        if (!this.__snapshot__) {
+            return columns.map((c) => c.Name);
+        }
+        const snapshot = this.__snapshot__;
+        return columns.filter((c) => !(0, snapshot_js_1.snapshotEquals)(snapshot.Columns.get(c.Name), this[c.Name], c.Converter)).map((c) => c.Name);
+    }
+    /**
+     * Foreign-key columns a relation object reported as rewritten, via {@link markDirty}.
+     *
+     * These are the only columns the snapshot diff cannot see. `SingleRelation.attach()` stores
+     * the new target on the relation wrapper and marks the foreign key dirty, but never writes
+     * the column on the model — the value is materialised from the relation later, by
+     * `StandardModelToSqlConverter`. So `changedColumns()` compares the column against its
+     * snapshot, finds it untouched, and reports no change even though the relation was
+     * re-pointed. Detaching a relation and calling `update()` would then emit nothing at all.
+     *
+     * Restricted to declared relation foreign keys on purpose. `__dirty_props__` also collects
+     * ordinary property writes, and folding those in wholesale would undo the precision the
+     * diff exists for: a column written A -> B -> A is in `__dirty_props__` but has no net
+     * change, and must not be written back.
+     */
+    relationDirtyColumns() {
+        const descriptor = this.ModelDescriptor;
+        if (!descriptor) {
+            return [];
+        }
+        const relationKeys = new Set();
+        for (const [, relation] of descriptor.Relations) {
+            if (relation.ForeignKey) {
+                relationKeys.add(relation.ForeignKey);
+            }
+        }
+        return this.__dirty_props__.filter((p) => relationKeys.has(p));
+    }
+    /**
+     * Records `prop` as changed and marks the model dirty.
+     *
+     * This is the supported way for relation objects to report that they rewrote one of the
+     * owner's foreign keys. It replaces the `(owner as any).__dirty_props__.push(...)` casts
+     * that reached into a private field from outside the class ( A6 ).
+     *
+     * The push comes before `IsDirty = true` so the method stays correct even if the
+     * `IsDirty` setter ever starts clearing `__dirty_props__` on a truthy assignment too.
+     *
+     * @param prop - column name
+     */
+    markDirty(prop) {
+        if (!this.__dirty_props__.includes(prop)) {
+            this.__dirty_props__.push(prop);
+        }
+        this.IsDirty = true;
+    }
     valueOf() {
         return this.PrimaryKeyValue;
     }
@@ -281,6 +425,11 @@ class ModelBase {
     static whereNotExists(_qOrR, _func) {
         throw new Error('Not implemented');
     }
+    /**
+     * Runs `_callback` inside a transaction on this model's connection. The transaction commits
+     * when the callback resolves and rolls back when it throws — see `OrmDriver.transaction`.
+     * Resolves with whatever the callback returned.
+     */
     static transaction(_callback) {
         throw new Error('Not implemented');
     }
@@ -290,6 +439,13 @@ class ModelBase {
          * prop to track model props that changeded since last update
          */
         this.__dirty_props__ = [];
+        /**
+         * Diff baseline, captured when this instance was hydrated from a database row.
+         * `null` means "this model has never been in the database", which is what `save()`
+         * uses to classify it as an INSERT — not the presence of a primary key, because
+         * `setDefaults()` pre-fills @Uuid keys on construction.
+         */
+        this.__snapshot__ = null;
         /**
          * List of hidden properties from JSON / dehydrations
          * eg. password field of user
@@ -318,26 +474,36 @@ class ModelBase {
     attach(data) {
         // TODO: refactor this, to not check every time for relation
         // do this as map or smth
-        for (const [_, v] of this.ModelDescriptor.Relations.entries()) {
-            if (v.TargetModel.name === data.constructor.name) {
-                // TODO: refactor this, so we dont update foreign key
-                // instead we must use belongsTo relation on data model to update
-                //(data as any)[v.ForeignKey] = this.PrimaryKeyValue;
-                switch (v.Type) {
-                    case interfaces_js_1.RelationType.One:
-                        this[v.Name].attach(data);
-                        this.__dirty_props__.push(v.ForeignKey);
-                        break;
-                    case interfaces_js_1.RelationType.Many:
-                        // attach to related model too
-                        const rel = [...data.ModelDescriptor.Relations.entries()].find((e) => e[1].ForeignKey === v.ForeignKey);
-                        if (rel) {
-                            data[rel[0]].Value = this;
-                        }
-                    case interfaces_js_1.RelationType.ManyToMany:
-                        this[v.Name].push(data);
-                        break;
+        for (const [, v] of this.ModelDescriptor.Relations.entries()) {
+            // Constructor identity, not class name. Name matching pushed the row into *every*
+            // relation whose target happened to share a name, so a model with two relations to
+            // the same target received it twice ( B26 ), and it breaks under minification ( A9 ).
+            if (v.TargetModel !== data.constructor) {
+                continue;
+            }
+            switch (v.Type) {
+                case interfaces_js_1.RelationType.One:
+                    this[v.Name].attach(data);
+                    this.markDirty(v.ForeignKey);
+                    break;
+                case interfaces_js_1.RelationType.Many: {
+                    // Set the child's back-reference to this owner, when the child declares one.
+                    const rel = [...data.ModelDescriptor.Relations.entries()].find((e) => e[1].ForeignKey === v.ForeignKey);
+                    if (rel) {
+                        data[rel[0]].Value = this;
+                    }
+                    this[v.Name].push(data);
+                    break;
                 }
+                case interfaces_js_1.RelationType.ManyToMany:
+                    // No back-reference: the link lives in the junction table, not on the target row.
+                    // The `push` is written out again rather than shared with the Many case above —
+                    // the two are only coincidentally similar, and the missing `break` that used to
+                    // join them was one reordering away from silently breaking.
+                    this[v.Name].push(data);
+                    break;
+                default:
+                    break;
             }
         }
         this.IsDirty = true;
@@ -374,10 +540,14 @@ class ModelBase {
      * deletes enitt from db. If model have SoftDelete decorator, model is marked as deleted
      */
     async destroy() {
-        if (!this.PrimaryKeyValue) {
+        // A composite key is a tuple, and a tuple is ALWAYS truthy - so the old `!pk` guard
+        // would happily issue a DELETE for a model whose key columns are still unset.
+        const pk = this.PrimaryKeyValue;
+        const missing = Array.isArray(pk) ? pk.some((v) => v === null || v === undefined) : !pk;
+        if (missing) {
             return;
         }
-        const result = await this.constructor.destroy(this.PrimaryKeyValue);
+        const result = await this.constructor.destroy(pk);
         this.IsDirty = false;
         return result;
     }
@@ -392,33 +562,64 @@ class ModelBase {
             throw new exceptions_js_1.OrmException('archived at column not exists in model');
         }
         const { query } = this.createUpdateQuery();
-        return await query.update(this.toSql()).where(this.PrimaryKeyName, this.PrimaryKeyValue);
+        query.update(this.toSql());
+        (0, primary_keys_js_1.wherePk)(query, this.ModelDescriptor, this.PrimaryKeyValue);
+        return await query;
     }
+    /**
+     * Writes the columns that differ from the snapshot.
+     *
+     * The change set comes from `changedColumns()` — the snapshot diff — and not from the
+     * proxy's `__dirty_props__`, which records a property as dirty on ANY write including one
+     * that puts the original value straight back. `save()` has always used the diff, and
+     * `changedColumns()` documents it as the more precise answer; this path used the imprecise
+     * one, so the same edit produced a different UPDATE depending on which method you called.
+     *
+     * A model with no snapshot ( never hydrated ) reports every column as changed, which is the
+     * right answer: there is no baseline to be more precise than.
+     *
+     * @param data - optional patch hydrated onto the model first
+     */
     async update(data) {
-        const { query } = this.createUpdateQuery();
-        let result = {
+        const result = {
             RowsAffected: 0,
             LastInsertId: 0,
         };
         if (data) {
             this.hydrate(data);
         }
-        // if no changes, return without update
-        if (this.IsDirty === false) {
+        const keyColumns = this.ModelDescriptor.PrimaryKey ?? [];
+        const changed = lodash_1.default.union(this.changedColumns(), this.relationDirtyColumns()).filter((c) => !keyColumns.includes(c));
+        // Nothing to write. Checked against the diff, so re-assigning a column its current value
+        // no longer produces an UPDATE that sets it to what it already was.
+        if (changed.length === 0) {
+            this.IsDirty = false;
             return result;
         }
-        if (this.ModelDescriptor.Timestamps.UpdatedAt) {
-            this[this.ModelDescriptor.Timestamps.UpdatedAt] = luxon_1.DateTime.now();
+        const updatedAt = this.ModelDescriptor.Timestamps.UpdatedAt;
+        if (updatedAt) {
+            this[updatedAt] = luxon_1.DateTime.now();
+            if (!changed.includes(updatedAt)) {
+                changed.push(updatedAt);
+            }
         }
-        result = await query.update(this.toSql(true)).where(this.PrimaryKeyName, this.PrimaryKeyValue);
+        const { query } = this.createUpdateQuery();
+        query.update(lodash_1.default.pick(this.toSql(), changed));
+        (0, primary_keys_js_1.wherePk)(query, this.ModelDescriptor, this.PrimaryKeyValue);
+        const updateResult = await query;
         this.IsDirty = false;
-        return result;
+        this.takeSnapshot();
+        return updateResult;
     }
     /**
      * Save all changes to db. It creates new entry id db or updates existing one if
      * primary key exists
      */
     async insert(insertBehaviour = interfaces_js_1.InsertBehaviour.None) {
+        // Both run BEFORE the query is built, so an `assigned` key that was never supplied fails
+        // without touching the database.
+        (0, primary_keys_js_1.generateClientSideKeys)(this, this.ModelDescriptor);
+        (0, primary_keys_js_1.assertAssignedKeys)(this, this.ModelDescriptor);
         const { query, description } = this.createInsertQuery();
         const sResponseMapper = query.Container.resolve(interfaces_js_1.ServerResponseMapper);
         switch (insertBehaviour) {
@@ -432,14 +633,27 @@ class ModelBase {
                 query.orReplace();
                 break;
         }
+        // Only an `auto` key needs the database to tell us what it became. Asking for RETURNING
+        // where the dialect supports it beats reading an identity counter, and is the shape
+        // orm-uow needs to backfill cascaded children.
+        const needsKeyBack = (0, primary_keys_js_1.pkColumns)(description).some((c) => (0, primary_keys_js_1.pkGeneration)(description, c) === 'auto');
+        if (needsKeyBack && insertBehaviour !== interfaces_js_1.InsertBehaviour.InsertOrUpdate && query.Driver.supportedFeatures().insertReturning) {
+            query.returning((0, primary_keys_js_1.pkColumns)(description));
+        }
         query.middleware({
             afterQuery: (data) => {
-                const response = sResponseMapper.read(data, this.PrimaryKeyName);
-                // if already exists do not overwrite
-                // sometimes we have models with primary key as string etc
-                // and not autoincrement
-                if (!this.PrimaryKeyValue) {
-                    this.PrimaryKeyValue = response.LastInsertId;
+                const response = sResponseMapper.read(data, (0, primary_keys_js_1.pkColumns)(description));
+                if ((response.Returning ?? []).length !== 0) {
+                    (0, primary_keys_js_1.setPkValue)(this, description, (0, primary_keys_js_1.pkValueOf)(response.Returning[0], description));
+                }
+                else if (needsKeyBack) {
+                    // Do not overwrite a key the caller already supplied ( uuid / assigned strategies ).
+                    // Same tuple-truthiness trap as destroy().
+                    const current = this.PrimaryKeyValue;
+                    const missing = Array.isArray(current) ? current.some((v) => v === null || v === undefined) : !current;
+                    if (missing) {
+                        this.PrimaryKeyValue = response.LastInsertId;
+                    }
                 }
                 return data;
             },
@@ -463,6 +677,26 @@ class ModelBase {
         }
         return await this.insert();
     }
+    /**
+     * Persists this model and everything reachable from it in one transaction.
+     *
+     * The graph is diffed against the snapshots taken when it was loaded, sorted so that a
+     * parent is inserted before any child that references it, and executed as inserts, then
+     * updates restricted to the columns that actually changed, then junction rows, then the
+     * orphan policy of every relation that lost a member.
+     *
+     * A relation that was never populated is invisible: `Items: OrderItem[] = []` on a freshly
+     * constructed model deletes nothing. That is the deliberate divergence from TypeORM.
+     *
+     * @param options - `{ reload: true }` to diff against current database state instead of the
+     *                  hydration snapshot; `{ chunk: n }` to bound batched statement size.
+     */
+    async save(options) {
+        // `UnitOfWork` is referenced only inside this body, never at module-evaluation time, so
+        // the model.ts -> unit-of-work.ts -> ... -> model.ts cycle stays safe under ESM. Do not
+        // move this into a field initializer or an extends clause.
+        return await unit_of_work_js_1.UnitOfWork.save(this, options);
+    }
     /**
      * Gets model data from database and returns as fresh instance.
      *
@@ -489,6 +723,7 @@ class ModelBase {
         for (const c of this.ModelDescriptor.Columns) {
             this[c.Name] = model[c.Name];
         }
+        this.IsDirty = false;
     }
     toJSON() {
         return this.dehydrate();
@@ -505,6 +740,9 @@ class ModelBase {
                 this[c.Name] = c.DefaultValue;
             }
         });
+        // `uuid` primary keys are generated at construction so the value is available to callers
+        // and to cascaded children before the row ever reaches the database.
+        (0, primary_keys_js_1.generateClientSideKeys)(this, this.ModelDescriptor);
         if (this.ModelDescriptor.Timestamps.CreatedAt) {
             this[this.ModelDescriptor.Timestamps.CreatedAt] = luxon_1.DateTime.now();
         }
@@ -539,9 +777,60 @@ class ModelBase {
     }
 }
 exports.ModelBase = ModelBase;
+/**
+ * Decides whether a multi-row insert's generated keys can be read off `LastInsertId + index` on a
+ * dialect that has no RETURNING.
+ *
+ * The premise is a documented MySQL guarantee, not a guess. InnoDB splits inserts into *simple*
+ * ones — row count known before execution, which is exactly what `INSERT INTO t (…) VALUES (…),
+ * (…)` is, and the only shape {@link InsertQueryBuilder} can build — and *bulk* ones
+ * (`INSERT … SELECT`), where it is not. For a simple insert InnoDB reserves one contiguous block
+ * of N auto-increment values under a short mutex it releases immediately, so the k-th row of the
+ * statement gets `LAST_INSERT_ID() + k`. This holds under `innodb_autoinc_lock_mode = 2`, the
+ * MySQL 8 default, and was verified against a live server. The "values may not be contiguous"
+ * caveat in the MySQL manual is about bulk inserts and about mixed-mode inserts.
+ *
+ * The guards below rule out every case where the mapping stops being positional.
+ */
+function _canBackfillContiguousKeys(description, rows, response, features, insertBehaviour) {
+    // Only a dialect whose reported id is the FIRST of the block can be walked forwards. MSSQL's
+    // SCOPE_IDENTITY() and SQLite's last_insert_rowid() report the LAST one.
+    if (!features.insertIdIsFirstOfBatch) {
+        return false;
+    }
+    // One database-generated identity column, or there is no counter to walk. A composite key has
+    // no single identity column, and uuid / assigned keys are already set by this point.
+    const keys = (0, primary_keys_js_1.pkColumns)(description);
+    if (keys.length !== 1 || (0, primary_keys_js_1.pkGeneration)(description, keys[0]) !== 'auto') {
+        return false;
+    }
+    // INSERT IGNORE / REPLACE / ON DUPLICATE KEY UPDATE are mixed-mode: rows can be skipped,
+    // replaced or updated rather than inserted, so the k-th allocated id stops belonging to the
+    // k-th input row. ( The array path rejects these outright today; this keeps the invariant
+    // local to the decision rather than depending on a check three hundred lines away. )
+    if (insertBehaviour !== interfaces_js_1.InsertBehaviour.None) {
+        return false;
+    }
+    // No identity value reported at all.
+    if (typeof response.LastInsertId !== 'number' || !Number.isFinite(response.LastInsertId) || response.LastInsertId <= 0) {
+        return false;
+    }
+    // The server must confirm it inserted exactly one row per row we sent. Anything else means
+    // rows were skipped or the statement did something other than a plain multi-row insert.
+    if (response.RowsAffected !== rows.length) {
+        return false;
+    }
+    // A batch where SOME rows carry an explicit key is a mixed-mode insert: InnoDB allocates
+    // auto-increment values only for the rows that omitted one, so index arithmetic would both
+    // mis-key the generated rows and overwrite the supplied ones.
+    return rows.every((v) => v instanceof ModelBase && (v.PrimaryKeyValue === null || v.PrimaryKeyValue === undefined));
+}
 function _preparePkWhere(description, query, model) {
-    if (description.PrimaryKey) {
-        query.where(description.PrimaryKey, model.PrimaryKeyValue);
+    // NOTE: `if (description.PrimaryKey)` used to be false for the '' default. An empty ARRAY is
+    // truthy, so this must be an explicit length check or no-primary-key models would stop
+    // falling back to their unique columns.
+    if ((0, primary_keys_js_1.hasPk)(description)) {
+        (0, primary_keys_js_1.wherePk)(query, description, model.PrimaryKeyValue);
     }
     else {
         const unique = description.Columns.filter((x) => x.Unique);
@@ -556,20 +845,20 @@ function _preparePkWhere(description, query, model) {
     }
 }
 function _prepareOrderBy(description, query, order) {
-    if (description.PrimaryKey) {
-        query.order(description.PrimaryKey, order ?? enums_js_1.SortOrder.DESC);
+    // orderByPk emits one ORDER BY term per key column and reports whether the model has a
+    // primary key at all - see the note in _preparePkWhere on why a length check is required.
+    if ((0, primary_keys_js_1.orderByPk)(query, description, order ?? enums_js_1.SortOrder.DESC)) {
+        return;
     }
-    else {
-        const unique = description.Columns.filter((c) => c.Unique);
-        if (unique.length !== 0) {
-            unique.forEach((c) => query.order(c.Name, order ?? enums_js_1.SortOrder.DESC));
-        }
-        else if (description.Timestamps?.CreatedAt) {
-            query.order(description.Timestamps.CreatedAt, order ?? enums_js_1.SortOrder.DESC);
-        }
-        else if (description.Timestamps?.UpdatedAt) {
-            query.order(description.Timestamps.UpdatedAt, order ?? enums_js_1.SortOrder.DESC);
-        }
+    const unique = description.Columns.filter((c) => c.Unique);
+    if (unique.length !== 0) {
+        unique.forEach((c) => query.order(c.Name, order ?? enums_js_1.SortOrder.DESC));
+    }
+    else if (description.Timestamps?.CreatedAt) {
+        query.order(description.Timestamps.CreatedAt, order ?? enums_js_1.SortOrder.DESC);
+    }
+    else if (description.Timestamps?.UpdatedAt) {
+        query.order(description.Timestamps.UpdatedAt, order ?? enums_js_1.SortOrder.DESC);
     }
 }
 class HistoricalModel {
@@ -610,6 +899,8 @@ exports.MODEL_STATIC_MIXINS = {
         }
         return driver;
     },
+    // Every branch now returns a builder or throws, so the `| undefined` is gone — it only ever
+    // described the unimplemented ManyToMany case. This matches ModelBase.populate's static stub.
     populate(relation, owner) {
         //TODO: fix cast
         const modelDescriptor = this.getModelDescriptor();
@@ -630,7 +921,7 @@ exports.MODEL_STATIC_MIXINS = {
             async afterHydration(_relationData) { },
         };
         switch (relationDescriptor.Type) {
-            case interfaces_js_1.RelationType.One:
+            case interfaces_js_1.RelationType.One: {
                 const { query: JoinQuery } = (0, builders_js_1.createQuery)(relationDescriptor.SourceModel, builders_js_1.SelectQueryBuilder);
                 // NOTE: we could use simple right join, but we use LEFT JOIN
                 // becouse sqlite does not support right join
@@ -640,19 +931,52 @@ exports.MODEL_STATIC_MIXINS = {
                     joinModel: relationDescriptor.TargetModel,
                     queryCallback: function () {
                         this.select(new builders_js_1.RawQuery(`\`${this.TableAlias}\`.*`));
-                    }
+                    },
+                    // Both were omitted, so the join compiled to `$source$.undefined`. A belongsTo
+                    // joins the owner's ForeignKey to the target's PrimaryKey — the same derivation
+                    // SelectQueryBuilder uses for RelationType.One.
+                    sourceTablePrimaryKey: relationDescriptor.ForeignKey,
+                    joinTableForeignKey: relationDescriptor.PrimaryKey,
                 });
-                JoinQuery.where(relationDescriptor.SourceModel.getModelDescriptor().PrimaryKey, owner);
+                // `wherePk`, not `where(descriptor.PrimaryKey, ...)`: PrimaryKey is a string[] since
+                // composite keys landed, and passing the array as a column name compiled to
+                // `column 0 not exists in model ...`.
+                (0, primary_keys_js_1.wherePk)(JoinQuery, relationDescriptor.SourceModel.getModelDescriptor(), owner instanceof ModelBase ? owner.PrimaryKeyValue : owner);
                 JoinQuery.middleware(hydrateMiddleware);
                 return JoinQuery;
-            case interfaces_js_1.RelationType.ManyToMany:
-                break;
+            }
+            case interfaces_js_1.RelationType.ManyToMany: {
+                // Was a bare `break`, so this returned undefined and every caller crashed on the
+                // result. Read the junction table, join the target, and project the target's columns
+                // — the same shape ManyToManyRelation.compile() builds. A sub-query would be more
+                // direct but `whereIn` takes value arrays only.
+                if (!relationDescriptor.JunctionModel) {
+                    throw new exceptions_js_1.OrmException(`relation ${relation} on ${modelDescriptor.Name} has no junction model`);
+                }
+                const { query: junctionQuery } = (0, builders_js_1.createQuery)(relationDescriptor.JunctionModel, builders_js_1.SelectQueryBuilder);
+                junctionQuery.clearColumns();
+                junctionQuery.leftJoin({
+                    joinModel: relationDescriptor.TargetModel,
+                    queryCallback: function () {
+                        this.select(new builders_js_1.RawQuery(`\`${this.TableAlias}\`.*`));
+                    },
+                    sourceTablePrimaryKey: relationDescriptor.JunctionModelTargetModelFKey_Name,
+                    joinTableForeignKey: relationDescriptor.ForeignKey,
+                });
+                junctionQuery.where(relationDescriptor.JunctionModelSourceModelFKey_Name, owner instanceof ModelBase ? owner.PrimaryKeyValue : owner);
+                junctionQuery.middleware(hydrateMiddleware);
+                return junctionQuery;
+            }
+            case interfaces_js_1.RelationType.Virtual:
             case interfaces_js_1.RelationType.Query:
                 throw new exceptions_js_1.OrmException(`Query population for relation type ${interfaces_js_1.RelationType[relationDescriptor.Type]} is not supported yet`);
-            case interfaces_js_1.RelationType.Many:
+            case interfaces_js_1.RelationType.Many: {
                 const { query } = (0, builders_js_1.createQuery)(relationDescriptor.TargetModel, builders_js_1.SelectQueryBuilder);
                 query.where(relationDescriptor.ForeignKey, owner instanceof ModelBase ? owner.PrimaryKeyValue : owner);
                 return query;
+            }
+            default:
+                throw new exceptions_js_1.OrmException(`unknown relation type ${relationDescriptor.Type} for relation ${relation} on ${modelDescriptor.Name}`);
         }
     },
     query() {
@@ -698,6 +1022,12 @@ exports.MODEL_STATIC_MIXINS = {
             if (insertBehaviour !== interfaces_js_1.InsertBehaviour.None) {
                 throw new exceptions_js_1.OrmException(`insert behaviour is not supported with arrays`);
             }
+            // Run the key strategies over every element BEFORE any SQL is built, so a missing
+            // `assigned` key fails with a clear message instead of a NOT NULL violation.
+            data.forEach((d) => {
+                (0, primary_keys_js_1.generateClientSideKeys)(d, description);
+                (0, primary_keys_js_1.assertAssignedKeys)(d, description);
+            });
             query.values(data.map((d) => {
                 if (d instanceof ModelBase) {
                     return d.toSql();
@@ -717,6 +1047,8 @@ exports.MODEL_STATIC_MIXINS = {
                     query.orReplace();
                     break;
             }
+            (0, primary_keys_js_1.generateClientSideKeys)(data, description);
+            (0, primary_keys_js_1.assertAssignedKeys)(data, description);
             if (data instanceof ModelBase) {
                 query.values(data.toSql());
             }
@@ -724,19 +1056,40 @@ exports.MODEL_STATIC_MIXINS = {
                 query.values(converter.toSql(data, description));
             }
         }
+        const autoKey = (0, primary_keys_js_1.pkColumns)(description).some((c) => (0, primary_keys_js_1.pkGeneration)(description, c) === 'auto');
+        if (autoKey && query.Driver.supportedFeatures().insertReturning) {
+            query.returning((0, primary_keys_js_1.pkColumns)(description));
+        }
         const iMidleware = {
             afterQuery: (result) => {
-                const response = sResponseMapper.read(result);
-                if (Array.isArray(data)) {
-                    data.forEach((v, idx) => {
+                const response = sResponseMapper.read(result, (0, primary_keys_js_1.pkColumns)(description));
+                const rows = Array.isArray(data) ? data : [data];
+                if ((response.Returning ?? []).length === rows.length) {
+                    // Authoritative: the database told us every key it assigned, in insert order.
+                    rows.forEach((v, idx) => {
                         if (v instanceof ModelBase) {
-                            v.PrimaryKeyValue = v.PrimaryKeyValue ?? response.LastInsertId + idx;
+                            (0, primary_keys_js_1.setPkValue)(v, description, (0, primary_keys_js_1.pkValueOf)(response.Returning[idx], description));
                         }
                     });
                 }
-                else if (data instanceof ModelBase) {
-                    data.PrimaryKeyValue = data.PrimaryKeyValue ?? response.LastInsertId;
+                else if (autoKey && rows.length === 1) {
+                    // One row, one identity value - safe.
+                    const v = rows[0];
+                    if (v instanceof ModelBase && !v.PrimaryKeyValue) {
+                        v.PrimaryKeyValue = response.LastInsertId;
+                    }
+                }
+                else if (_canBackfillContiguousKeys(description, rows, response, query.Driver.supportedFeatures(), insertBehaviour)) {
+                    // Multi-row `INSERT ... VALUES` on a dialect with no RETURNING whose identity value is
+                    // the first of the statement's contiguous block. See _canBackfillContiguousKeys.
+                    rows.forEach((v, idx) => {
+                        v.PrimaryKeyValue = response.LastInsertId + idx;
+                    });
                 }
+                // Anything else — a dialect whose insert id names the last row, a batch that mixed
+                // supplied and generated keys, a statement the server did not insert one row per input
+                // row for — cannot be mapped positionally, so nothing is assigned. Callers needing the
+                // keys there must re-select or insert the models one at a time.
                 return result;
             },
             modelCreation: () => null,
@@ -747,16 +1100,14 @@ exports.MODEL_STATIC_MIXINS = {
     },
     async find(pks) {
         const { query, description } = (0, builders_js_1.createQuery)(this, builders_js_1.SelectQueryBuilder);
-        const pkey = description.PrimaryKey;
         query.select('*');
-        query.whereIn(pkey, pks);
+        (0, primary_keys_js_1.whereAnyPk)(query, description, pks);
         return await query;
     },
     async findOrFail(pks) {
         const { query, description, model } = (0, builders_js_1.createQuery)(this, builders_js_1.SelectQueryBuilder);
-        const pkey = description.PrimaryKey;
         query.select('*');
-        query.whereIn(pkey, pks);
+        (0, primary_keys_js_1.whereAnyPk)(query, description, pks);
         const result = await query;
         if (result.length !== pks.length) {
             throw new Error(`could not find all results for model ${model.name}`);
@@ -765,22 +1116,23 @@ exports.MODEL_STATIC_MIXINS = {
     },
     async get(pk) {
         const { query, description } = (0, builders_js_1.createQuery)(this, builders_js_1.SelectQueryBuilder);
-        const pkey = description.PrimaryKey;
         query.select('*');
-        query.where(pkey, pk);
+        (0, primary_keys_js_1.wherePk)(query, description, pk);
         _prepareOrderBy(description, query);
         return (await query.first());
     },
     async getOrFail(pk) {
         const { query, description } = (0, builders_js_1.createQuery)(this, builders_js_1.SelectQueryBuilder);
-        const pkey = description.PrimaryKey;
         query.select('*');
-        query.where(pkey, pk);
+        (0, primary_keys_js_1.wherePk)(query, description, pk);
         _prepareOrderBy(description, query);
         return (await query.firstOrFail());
     },
     destroy(pks) {
         const description = (0, builders_js_1._descriptor)(this);
+        if (pks === undefined || pks === null) {
+            throw new exceptions_js_1.OrmException('Cannot destroy without primary keys ( unbounded DELETE/UPDATE ). Use truncate() to clear the whole table.');
+        }
         const data = Array.isArray(pks) ? pks : [pks];
         if (data.length === 0) {
             throw new exceptions_js_1.OrmException('Cannot delete empty array of primary keys');
@@ -792,7 +1144,7 @@ exports.MODEL_STATIC_MIXINS = {
             });
         }
         if (pks) {
-            query.whereIn(description.PrimaryKey, data);
+            (0, primary_keys_js_1.whereAnyPk)(query, description, data);
         }
         return query;
     },
@@ -804,8 +1156,8 @@ exports.MODEL_STATIC_MIXINS = {
     async getOrCreate(pk, data) {
         const { query, description } = (0, builders_js_1.createQuery)(this, builders_js_1.SelectQueryBuilder);
         // pk constrain
-        if (description.PrimaryKey && pk !== null) {
-            query.where(description.PrimaryKey, pk);
+        if ((0, primary_keys_js_1.hasPk)(description) && pk !== null) {
+            (0, primary_keys_js_1.wherePk)(query, description, pk);
         }
         // check for all unique columns ( unique constrain )
         description.Columns.filter((c) => c.Unique).forEach((c) => {
@@ -834,13 +1186,15 @@ exports.MODEL_STATIC_MIXINS = {
         let entity = (await query.first());
         if (!entity) {
             const toHydrate = data ?? {};
-            const primaryKey = description.Columns.find((c) => c.PrimaryKey);
-            // remove primary key from data to hydrate
-            // we dont want to set primary key on new model if not exists
-            // and autoincrement is set
-            if (primaryKey?.AutoIncrement) {
-                delete toHydrate[description.PrimaryKey];
-            }
+            // Do not carry an auto-increment key into a brand new model; the engine assigns it.
+            // Every key column is checked, not just the first, so a composite key with an
+            // auto-increment member is stripped correctly.
+            (0, primary_keys_js_1.pkColumns)(description).forEach((name) => {
+                const col = description.Columns.find((c) => c.Name === name);
+                if (col?.AutoIncrement) {
+                    delete toHydrate[name];
+                }
+            });
             entity = new (Function.prototype.bind.apply(this))(toHydrate);
             return entity;
         }
@@ -849,10 +1203,12 @@ exports.MODEL_STATIC_MIXINS = {
     async exists(pk) {
         const { query, description } = (0, builders_js_1.createQuery)(this, builders_js_1.SelectQueryBuilder);
         // pk constrain
-        if (description.PrimaryKey && pk !== null) {
-            query.where(description.PrimaryKey, pk);
+        if ((0, primary_keys_js_1.hasPk)(description) && pk !== null) {
+            (0, primary_keys_js_1.wherePk)(query, description, pk);
         }
-        const result = await query.clearColumns().select(description.PrimaryKey).first();
+        const q = query.clearColumns();
+        (0, primary_keys_js_1.pkColumns)(description).forEach((c) => q.select(c));
+        const result = await q.first();
         if (result) {
             return true;
         }
@@ -916,7 +1272,8 @@ exports.MODEL_STATIC_MIXINS = {
         if (callback) {
             callback(query);
         }
-        return await (await query.asRaw()).count;
+        const row = await query.takeFirst().asRaw();
+        return row?.count ?? 0;
     },
     async transaction(callback) {
         const driver = this.getModelDescriptor();
@@ -924,8 +1281,7 @@ exports.MODEL_STATIC_MIXINS = {
     }
 };
 const _modelProxyFactory = (_c, model) => {
-    const mInstance = new model();
-    return new Proxy(mInstance, MODEL_PROXY_HANDLER);
+    return new model();
 };
 exports._modelProxyFactory = _modelProxyFactory;
 di_1.DI.register(exports._modelProxyFactory).as('__orm_model_factory__');